Employees are people who belong to the organization through a tenant membership. Invite them by email, then manage the access roles and the governance access their membership carries.
- 1
Invite the employee
Enter the work identity and send the organization invitation.
- 2
Assign access
Grant the access roles needed for the person’s product responsibilities.
- 3
Assign organizational responsibility separately
Use Administration → Responsibility when the person holds a Role.
Membership and Role are different
Membership lets a person enter the organization. An access role controls what they may do. A responsibility Role describes what they own or belong to. Keep these decisions separate so changing a job does not accidentally remove identity or overgrant access.
Remove access deliberately
Removing a person passes the Roles they held to the closest person up the hierarchy, and their personal access tokens and connected accounts stop working immediately. A Standard must not be left without the accountable ownership required for publication.
Follow least privilege
Grant the smallest access roles needed. Administrators retain full access; non-admin access is the union of explicit grants and remains deny-by-default.
Keep records current
Use recognizable work identities and remove stale invitations. Accurate employee data makes audit events and ownership understandable later.